Out-Of-Bounds Buffer Read Vulnerability in Thunderbird by Mozilla
CVE-2026-92239

Currently unrated

Key Information:

Vendor: Mozilla
Status: Thunderbird
Vendor: CVE Published:; 15 September 2026

What is CVE-2026-92239?

A maliciously constructed IMAP line can lead to an out-of-bounds buffer read in Thunderbird, potentially providing an attacker with unauthorized access to sensitive data. This issue was addressed in Thunderbird version 140.16, which mitigates the risk associated with this vulnerability.

Affected Version(s)

Thunderbird 140.16

Thunderbird 156

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2060488

https://www.mozilla.org/security/advisories/mfsa2026-94/

https://www.mozilla.org/security/advisories/mfsa2026-95/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 15, 2026
Vulnerability Reserved
Sep 15, 2026

Credit

Ramesh Adhikari, Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India)

CVE-2026-92239 Data

JSON